The official Claude Code extension has been compromised

Experts have documented the compromise of the official Claude Code extension for the VS Code editor on the Cursor Marketplace. The malicious code activates a persistent backdoor for remote access via the SSH protocol.

The injected mechanism affects macOS, Linux, and Windows operating systems. However, a software bug was discovered in the macOS logic that prevents the Remote Login feature from being fully enabled on Apple devices.

The incident affects developers who use third-party marketplaces to install their programming environment. Users are advised to check their installed plugins for unauthorized changes.